Skip to content

Commit e7f5d9a

Browse files
memildinmemildin
committed
Added the list of supported ports
1 parent 884ebd7 commit e7f5d9a

File tree

1 file changed

+83
-15
lines changed

1 file changed

+83
-15
lines changed

‎articles/security-center/security-center-adaptive-network-hardening.md

Lines changed: 83 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Adaptive Network Hardening in Azure Security Center | Microsoft Docs
3-
description: Learn how to harden, based on actual traffic patterns, your network security groups (NSG) rules and further improve your security posture.
3+
description: Learn how to use actual traffic patterns to harden your network security groups (NSG) rules and further improve your security posture.
44
services: security-center
55
documentationcenter: na
66
author: memildin
@@ -12,9 +12,10 @@ ms.devlang: na
1212
ms.topic: conceptual
1313
ms.tgt_pltfrm: na
1414
ms.workload: na
15-
ms.date: 05/24/2019
15+
ms.date: 03/11/2020
1616
ms.author: memildin
1717
---
18+
1819
# Adaptive Network Hardening in Azure Security Center
1920
Learn how to configure Adaptive Network Hardening in Azure Security Center.
2021

@@ -23,12 +24,79 @@ Applying [network security groups (NSG)](https://docs.microsoft.com/azure/virtua
2324

2425
Adaptive Network Hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.
2526

26-
For example, let’s say the existing NSG rule is to allow traffic from 140.20.30.10/24 on port 22. The Adaptive Network Hardening’s recommendation, based on the analysis, would be to narrow the range and allow traffic from 140.23.30.10/29 – which is a narrower IP range, and deny all other traffic to that port.
27+
For example, let's say the existing NSG rule is to allow traffic from 140.20.30.10/24 on port 22. The Adaptive Network Hardening's recommendation, based on the analysis, would be to narrow the range and allow traffic from 140.23.30.10/29 – which is a narrower IP range, and deny all other traffic to that port.
2728

2829
![network hardening view](./media/security-center-adaptive-network-hardening/traffic-hardening.png)
2930

30-
> [!NOTE]
31-
> Adaptive Network Hardening recommendations are supported on the following ports: 22, 3389, 21, 23, 445, 4333, 3306, 1433, 1434, 53, 20, 5985, 5986, 5432, 139, 66, 1128
31+
32+
## Which ports are supported?
33+
34+
Adaptive Network Hardening recommendations are only supported on specific ports. This table gives you the full list:
35+
36+
|Port|Protocol|Associated Service|
37+
|:---:|:----:|:----|
38+
|13|UDP|Daytime service|
39+
|17|UDP|QOTD protocol|
40+
|19|UDP|CHARGEN protocol|
41+
|22|TCP|SSH|
42+
|23|TCP|Telnet|
43+
|53|UDP|DNS|
44+
|69|UDP|TFTP|
45+
|81|TCP|Potentially malicious (TOR exit node)|
46+
|111|TCP/UDP|RPC|
47+
|119|TCP|NNTP|
48+
|123|UDP|NTP|
49+
|135|TCP/UDP|Endpoint Mapper; RPC; DCE|
50+
|137|TCP/UDP|NetBIOS Name Service|
51+
|138|TCP/UDP|NetBIOS Datagram Service|
52+
|139|TCP|NetBIOS Session Service|
53+
|161|TCP/UDP|SNMP|
54+
|162|TCP/UDP|SNMP|
55+
|389|TCP|LDAP|
56+
|445|TCP|SMB|
57+
|512|TCP|Rexec|
58+
|514|TCP|Remote shell|
59+
|593|TCP/UDP|HTTP RPC|
60+
|636|TCP|LDAP|
61+
|873|TCP|Rsync|
62+
|1433|TCP|MS SQL|
63+
|1434|UDP|MS SQL|
64+
|1900|UDP|SSDP|
65+
|1900|UDP|SSDP|
66+
|2049|TCP/UDP|NFS|
67+
|2301|TCP|Compaq management service|
68+
|2323|TCP|3d-nfsd|
69+
|2381|TCP|Compaq management service|
70+
|3268|TCP|LDAP|
71+
|3306|TCP|MySQL|
72+
|3389|TCP|RDP|
73+
|4333|TCP|mSQL|
74+
|5353|UDP|mDNS|
75+
|5432|TCP|PostgreSQL|
76+
|5555|TCP|Personal Agent; HP OmniBack|
77+
|5800|TCP|VNC|
78+
|5900|TCP|Remote framebuffer; VNC|
79+
|5900|TCP|VNC|
80+
|5985|TCP|Windows PowerShell|
81+
|5986|TCP|Windows PowerShell|
82+
|6379|TCP|Redis|
83+
|6379|TCP|Redis|
84+
|7000|TCP|Cassandra|
85+
|7001|TCP|Cassandra|
86+
|7199|TCP|Cassandra|
87+
|8081|TCP|CosmosDB; Sun Proxy Admin|
88+
|8089|TCP|Splunk|
89+
|8545|TCP|Potentially malicious (Cryptominer)|
90+
|9042|TCP|Cassandra|
91+
|9160|TCP|Cassandra|
92+
|9300|TCP|Elasticsearch|
93+
|11211|UDP|Memcached|
94+
|16379|TCP|Redis|
95+
|26379|TCP|Redis|
96+
|27017|TCP|MongoDB|
97+
|37215|TCP|Potentially malicious|
98+
||||
99+
32100

33101
## View Adaptive Network Hardening alerts and rules
34102

@@ -38,7 +106,7 @@ For example, let’s say the existing NSG rule is to allow traffic from 140.20.3
38106
* **Unscanned resources**: VMs that the Adaptive Network Hardening algorithm cannot be run on because of one of the following reasons:
39107
* **VMs are Classic VMs**: Only Azure Resource Manager VMs are supported.
40108
* **Not enough data is available**: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.
41-
* **VM is not protected by ASC standard**: Only VMs that are set to Security Center’s Standard pricing tier are eligible for this feature.
109+
* **VM is not protected by ASC standard**: Only VMs that are set to Security Center's Standard pricing tier are eligible for this feature.
42110

43111
![unhealthy resources](./media/security-center-adaptive-network-hardening/unhealthy-resources.png)
44112

@@ -74,19 +142,19 @@ You may want to modify the parameters of a rule that has been recommended. For e
74142

75143
Some important guidelines for modifying an Adaptive Network Hardening rule:
76144

77-
* You can modify the parameters of “allow” rules only.
78-
* You cannot change “allow” rules to become “deny” rules.
145+
* You can modify the parameters of "allow" rules only.
146+
* You cannot change "allow" rules to become "deny" rules.
79147

80148
> [!NOTE]
81-
> Creating and modifying “deny” rules is done directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
149+
> Creating and modifying "deny" rules is done directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
82150
83-
* A **Deny all traffic** rule is the only type of “deny” rule that would be listed here, and it cannot be modified. You can, however, delete it (see [Delete a rule](#delete-rule)).
151+
* A **Deny all traffic** rule is the only type of "deny" rule that would be listed here, and it cannot be modified. You can, however, delete it (see [Delete a rule](#delete-rule)).
84152
> [!NOTE]
85-
> A **Deny all traffic** rule is recommended when, as a result of running the algorithm, Security Center does not identify traffic that should be allowed, based on the existing NSG configuration. Therefore, the recommended rule is to deny all traffic to the specified port. The name of this type of rule is displayed as “*System Generated*”. After enforcing this rule, its actual name in the NSG will be a string comprised of the protocol, traffic direction, “DENY”, and a random number.
153+
> A **Deny all traffic** rule is recommended when, as a result of running the algorithm, Security Center does not identify traffic that should be allowed, based on the existing NSG configuration. Therefore, the recommended rule is to deny all traffic to the specified port. The name of this type of rule is displayed as "*System Generated*". After enforcing this rule, its actual name in the NSG will be a string comprised of the protocol, traffic direction, "DENY", and a random number.
86154
87155
*To modify an Adaptive Network Hardening rule:*
88156

89-
1. To modify some of the parameters of a rule, in the **Rules** tab, click on the three dots (...) at the end of the rule’s row, and click **Edit**.
157+
1. To modify some of the parameters of a rule, in the **Rules** tab, click on the three dots (...) at the end of the rule's row, and click **Edit**.
90158

91159
![edit rule](./media/security-center-adaptive-network-hardening/edit-hard-rule.png)
92160

@@ -103,10 +171,10 @@ Some important guidelines for modifying an Adaptive Network Hardening rule:
103171

104172
### Add a new rule <a name ="add-rule"> </a>
105173

106-
You can add an “allow” rule that was not recommended by Security Center.
174+
You can add an "allow" rule that was not recommended by Security Center.
107175

108176
> [!NOTE]
109-
> Only “allow” rules can be added here. If you want to add “deny” rules, you can do so directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
177+
> Only "allow" rules can be added here. If you want to add "deny" rules, you can do so directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
110178
111179
*To add an Adaptive Network Hardening rule:*
112180

@@ -130,7 +198,7 @@ When necessary, you can delete a recommended rule for the current session. For e
130198

131199
*To delete an Adaptive Network Hardening rule for your current session:*
132200

133-
1. In the **Rules** tab, click on the three dots (...) at the end of the rule’s row, and click **Delete**.
201+
1. In the **Rules** tab, click on the three dots (...) at the end of the rule's row, and click **Delete**.
134202

135203
![hardening rules](./media/security-center-adaptive-network-hardening/delete-hard-rule.png)
136204

0 commit comments

Comments
 (0)